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The no-cloning principle tells us that non-orthogonal quantum states cannot be cloned, but it 
does not tell us that orthogonal states can always be cloned. We suggest a situation where the 
cloning transformations are restricted, leading to a novel type of no-cloning principle. In the case 
of a composite system made of two subsystems: if the subsystems are only available one after the 
other then there are various cases when orthogonal states cannot be cloned. Surprising examples are 
given, which give a radically better insight regarding the basic concepts of quantum cryptography. 



The no-cloning theorem describes one of the most fun- 
damental non-classical properties of quantum systems. 
It states that an unknown quantum state cannot be 
cloned J^,^]. Assuming that such a quantum pure state 
p can be cloned leads to a violation of unitarity of quan- 
tum mechanics. Even if there is some information about 
the state (e.g., it is either po or pi) it cannot be cloned 
in the general case. This means that we cannot create 
a copying device which gets the unknown state (p p ) as 
an input and produces two copies of it at the output. 
Another version of the no-cloning theorem ji| states that 
any attempt of learning something regarding the input 
state of the copying device (even an attempt of making 
a very faint imprint) will necessarily induce some distur- 
bance in the output state; This principle presents a very 
interesting variation of the so called "uncertainty princi- 
ple" since it applies to an individual system; see M for 
more details. 

Let po = \(f>o)(4>o\ and p\ = \4>i)((f>i\ be two non iden- 
tical pure states provided by the producer (Alice), and 
suppose that these states are known to the person (Eve) 
who attempts to clone them. Let Eve receive one of them 
(p p ) — without knowing which one — as an input of her 
cloning (copying) device, and assume the initial normal- 
ized pure state of the cloning device is E. Then, a success 
to clone, that is, to create a product state p p p p from the 
unknown input state p p , is described by 

Ep p — > Ep'ppPp (1) 

where the dimensionality of the primed system E' 
is smaller than the dimensionality of E. This 
process violates unitarity if the states are non- 
orthogonal: unitarity promises that Tr(EE)Tr(popi) — 
Ti(E Q ' E 1 ')Tr(p p 1 )Tr(p pi); using the normalization 
conditions we get Tv(EE) = 1 and Tt(E 'Ei) < 1, so 
for non-identical states with Tr(poPi) < 1, cloning is im- 
possible unless Tr(poPi) = 0. Hence, non- identical states 
can be cloned only if they are orthogonal. In the cloning 
process above, Eve knows the set of states p p , and there- 
fore, in case they are identical she can clone them; the 



cloning device creates the state p = po = p\ without 
measuring anything. In the more effective version of the 
no cloning theorem || the states changes according to 

Epp — > EpPp . (2) 

In this case unitarity promises us that Tr(£ , £ , )Tr(/9 pi) = 
Tr(p /Oi)Tr(£!o-Ei), leading to Tr(£ £i) = 1 for (non- 
identical) non-orthogonal states. Thus Eq and E\ are 
identical and can provide no information on p p . We shall 
refer to this process as no-imprint principle to distinguish 
it from the no-cloning principle of Eq. (1). If Eq and E\ 
are not identical (hence, provide information) in an im- 
print process, then the output states cannot be identical 
to the input states p p . See Q for detailed analysis of in- 
formation vs. disturbance in case of non-zero disturbance 
in an imprint process. 

These conclusions apply also when p p are mixed states, 
telling us that only identical or orthogonal states p p can 
be cloned using the first process Q or imprinted using 
the second process. However, the situation is more deli- 
cate since such processes do not provide a complete de- 
scription of Eve's possible strategics when p p are mixed 
states! The no-cloning of quantum mixed states was re- 
cently analyzed, and it was shown that, while commuting 
non-orthogonal quantum mixed states cannot be cloned 
[using Eq. (1)], they can still be broadcast [^J: Eve can 
create a state Xp sucn that 

X v + P v ® P P (3) 

but which satisfies 

Tr E [Xp] = Tr A [x p ] = p p . (4) 

A similar extension of Eq.(2) to achieve a "broadcast- 
imprint" process is straight forward. Surprisingly, it is 
not restricted to commuting density matrices and a 
complete analysis is still missing. Due to Eq. (3) (or its 
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counterpart when performing a broadcast-imprint pro- 
cess of mixed states), the state of the cloning device is 
entangled with the state of the system. 

These no-cloning theorems prove that non-orthogonal 
states cannot be cloned, and that cloning of orthogonal 
states is possible if arbitrary unitary transformation can 
be chosen. In this work we suggest to restrict the allowed 
unitary transformations. We show that, as result of this 
restriction, there are orthogonal states which cannot be 
cloned. We suggest a particular restriction, where po and 
pi are two orthogonal states of a composite system and 
the subsystems from which the system is composed are 
only available (to the cloning device) one after the other. 
Other restrictions are also possible, and lead to very fas- 
cinating examples @ . 

The restriction of the type we use here is typical in 
quantum key distribution. We show that "no cloning of 
orthogonal states" is the basic principle used in many 
quantum key distribution schemes, rather than the stan- 
dard no-cloning arguments, as was previously argued and 
believed. Hence, we shed new light on the possible basic 
concepts which are at the roots of secure quantum key 
distribution. 

Let the system A in Alice's hands be composed of two 
subsystems A\ and A2, such that the possible states pro- 
vided by Alice, ^ p (AiA 2 ), are orthogonal to each other, 
in the Hilbert space of the composite system. If the two 
subsystems were provided to Eve together she could clone 
the states. However, the subsystems are provided to Eve 
only one after the other so she cannot access the second 
one while she holds the first. Let p p (Ai) = Tr J 4 2 ($ p ) 
be the reduced density matrices of the first subsystem, 
and assume that the two (or more) possible states are 
non-identical and non-orthogonal. Consider Eve's pos- 
sible strategies when she holds the first subsystem A\. 
Clearly, if she changes p p (Ai) before letting it go her 
cloning attempt fails since she will have no access to that 
subsystem in the future. Thus, she cannot use the cloning 
process or imprint process. However, she can still use a 
broadcast-cloning process or a broadcast-imprint process. 
We only need to verify that these processes shall not al- 
low her to clone in our scenario: Indeed, if the states 
of the first subsystem are non-orthogonal, Eve might be 
able to achieve a broadcast, but the state of the first sub- 
system necessarily becomes entangled with Eve's state, 
hence cannot be fully entangled (or fully correlated) with 
the second subsystem anymore. Therefore, although the 
state Pp(Ai) does not change in the broadcast process, 
the state & p necessarily changes, and noise is induced. 
The last thing we should worry about is that Eve will not 
be able to clone by obtaining the entire information from 
the second subsystem, meaning that p p (A 2 ) = Tr^^p) 
must be non orthogonal as well. 

Thus, based on the previous discussion, we reach a 
novel no cloning principle for orthogonal states. — The 
two (or more) orthogonal states p p (A 1 A 2 ) of the system 



composed of (Ai) and (A 2 ) cannot be cloned if the re- 
duced density matrices of the subsystem which is avail- 
able first (say A{) 

Pp (A 1 )=Tt A2 [ Pp (A 1 A 2 )] (5) 

are non orthogonal and non identical, and if the reduced 
density matrices of the second subsystem are non orthog- 
onal. 

The first case we study is the case where the two sub- 
systems are entangled, such that the first subsystem Ai 
is in one of two commuting mixed states. Let Ai and A 2 
be two qubits with |0b) and the basis vectors of the 
b'th qubit. Let the initial states be the two orthogonal 
states g 

ipo = cosa|0i (g) 1 2 ) +sina|li <g) 2 ) (6) 

tpi = sina|0i <S> I2) — cosa|li ® 2 ) , (7) 

and a is known to the doner. In case a = or a = ir/2 all 
data is already contained in the first particle. In terms of 
cloning of the first subsystem - the two possible reduced 
states are orthogonal, hence can be cloned. In case of 
a = 7r/4 (so that cos a = sin a = 1/ \/2) the two possible 
reduced states of the first subsystem are identical. Thus, 
Eve can release a dummy qubit (denoted by £3) of her 
own, entangled with another one (denoted by £4), say 
in a state ip = (VV2)|0 3 <g> 1 4 ) + (l/v / 2)|l 3 <g> 4 ), while 
keeping subsystem A±. The reduced state of the dummy 
particle is equal to the state of the first subsystem. Later 
on, after receiving subsystem A 2 and learning the state of 
the combined system AiA 2 , Eve can change the state of 
(E3E4) by a simple transformation on particle £4 alone. 
In terms of cloning of the first system - the two possible 
states are the same, the completely mixed state, hence 
can be cloned. For all other a, there is no strategy for 
Eve to learn the data, or even to get some information 
unless disturbing the state. The reduced density matrix 
of the first particle (particle 1) are 

po = cos 2 a|0)(0| +sin 2 a|l)(l| (8) 

and 

pi = sin 2 a|0)(0| + cos 2 a|l)(l| . (9) 

The two density matrix commutes, but they are not or- 
thogonal nor identical. Therefore they can be broad- 
cast, but they can not be cloned, meaning that the 
resultant state of of A\ and £ can be x p (^4iC) such 
that Tr E [x P {AiE)] = p p and Tr^ [xp^i-E)] = Pp but 
X P {A\C) is not a tensor product of these two matrices. 
Therefore, Eve's system is entangled with A±, and some 
noise is necessarily introduced since the resulting (three- 
particle) state is not a tensor product of Alice's (two- 
particle) state and Eve's state. 
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This example (in a somewhat different form which 
uses Fock states) was suggested recently by Koashi and 
Imoto H for quantum key distribution. It was suggested 
as a generalization and modification of a previous scheme 
of Goldenberg and Vaidman 0. Goldenberg and Vaid- 
man (GV) were the first to realize that one can use 
orthogonal states for quantum key distribution. Their 
work H emphasizes that non-orthogonal states are not 
crucial in quantum cryptography, but it does not discuss 
it in terms of no-cloning of the reduced density matrices 
of the first subsystem as we do here. GV's scheme is 
using random timing, since it uses the case of a = 7r/4 
which, without random timing, is insecure. Hence, it ac- 
tually uses (as is explained in [||) three orthogonal states, 
where the third one is 

V'2 = |0i)|0 2 ) , (10) 

(which is the vacuum state in their description) with a 
reduced density matrix 

P2 = |0)<0|. (11) 

This state t/> 2 is used only for error verification. [To ob- 
serve that indeed || used three states, one must describe 
their work using Fock states |QW) etc. in arms a and b}. 
Note that in this case, the three possible reduced density 
matrices of the first particle are still commuting, but they 
are not identical, hence can be broadcast but not cloned. 

In a comment to M, Peres Jl0| emphasizes that, as 
far as Alice is concerned, previous schemes for quantum 
cryptography such as the original (four-state) key distri- 
bution scheme of |nj also use orthogonal states, since, in 
the four-state scheme Alice chooses one of two orthogonal 
states in a basis of her choice. Peres also emphasizes the 
need of a second stage, where classical information is pro- 
vided to Eve (regarding the basis in the four-state scheme 
or the random timing in GV scheme) when Eve has no 
longer access to the quantum data. Sec also Goldenberg- 
Vaidman reply fll2| . Note that we do not consider the 
case of spatial separation, but only the case of "time sep- 
aration" . 

Using our new form of the no cloning argument we 
provide a stronger statement: in both the GV scheme 
and the four-state scheme the states which are transmit- 
ted through Eve are orthogonal! This is a very surprising 
result, since (a). — it tells us that entanglement is not vi- 
tal for preventing cloning of orthogonal states, and since 
(b). — it was always believed that the four-state scheme 
uses four non-orthogonal states (see explanation in ]T^ ] 
for instance). 

In the following we show striking similarities between 
GV scheme and the four-state scheme, which are far be- 
yond the similarity shown by Peres. To achieve this un- 
derstanding we present a non-standard, fully quantum 
description of the four-state scheme, which however, is 
completely equivalent to the standard description. We 



claim that the standard belief that quantum key distri- 
bution is based upon the no-cloning theorem of Eq. (2) 
is inappropriate: In quantum key distribution Alice's 
states are sent to another person (Bob) who must be 
able to learn them (at least sometimes). The states are 
sent through Eve. It is not enough to prevent Eve from 
learning the encoded bits, but we also need to make sure 
that Bob can learn them. Thus, a standard no-cloning 
argument does not suffice as the basis of quantum key 
distribution. Indeed, using a complete quantum descrip- 
tion, we show that our no-cloning argument for orthog- 
onal states is actually used in the standard four-state 
scheme of fljj] . 

Let and 1 form a basis of two dimensional Hilbert 
space and let 0* = (1/V2)[0 + 1] and l x = (1/V2)[0 - 
1]. Let Alice prepare one of the following four states 
Ito.) = |0i0a), = |0fl a ), |&.) = |liO a ), and 

I^O = llfla)) which are all orthogonal to each other. 
The first qubit (qubit 1) is in one of four pure states |0); 
|1); (1/V2)|0+1); (1/V2)|0-1), which are the states used 
in the conventional form of |ll[] , and the second qubit car- 
ries classical information telling whether the first qubit 
was prepared in one basis or the other. 

Consider the two mixed states 

Xo = |0o.X0o,l + I0oJ(0oJ = |0i0 2 )(0 1 2 | + |0fl 2 )(0fl 2 | 

(12) 

and 

Xi = I01.X01.I + IK) (01. 1 = |1i0 2 )(1i0 2 | + [lfl 2 ><lfla| , 

(13) 

which are used to encode and 1 respectively, and are 
sent to Bob through Eve. [Note that combining each pair 
of states into one mixture is a result of the fact that the 
secret bit (the data that should be cloned) in Q is de- 
fined by these mixed states]. The two mixed states \p 
are orthogonal, since each of the pure states which de- 
compose one of the matrices is orthogonal to the states 
which decompose the other. The reduced density matri- 
ces of particle 1 (when particle 2 is traced out from the 
states Xp) again have the form 

po = cos 2 a|0')(0'| +sin 2 a|l')(l'| (14) 

and 

px = sin 2 a|0')(0'| +cos 2 a|l')(l'| (15) 

(in a basis, denoted by the prime, which is exactly 
between the standard (z) basis and the x basis used 
above, and is also known as the Breidbart basis), with 
cos 2 a — (1 + l/\/2)/2. These density matrices are com- 
muting but not orthogonal. Therefore the two density 
matrices can be broadcast but not cloned, and any at- 
tempt of cloning them will create noise. 
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Note that we ignored the irrelevant step in which Bob 
is telling Alice his choice of basis. This step is required 
in the original protocol due to technological limitations, 
and can be eliminated once Bob keeps the first particle 
(in a quantum state) till receiving the second. However, 
it is crucial that Bob receives the first particle before Alice 
sends the second and communication from Bob to Alice 
is required to verify this. 

This far we have seen the impossibility to clone three 
orthogonal states when two are entangled || , the impos- 
sibility to clone two orthogonal entangled states || and 
the impossibility to clone four non-entangled (product) 
states or two non-entangled (sum of product) density 
matrices (our description of jy}). Let us search for sim- 
pler cases, with non entangled orthogonal states. Such a 
case will make the best use of the new no-cloning theo- 
rem stated in this work. Furthermore, such orthogonal 
states which cannot be cloned are useful for quantum key 
distribution, and might be simpler to implement, or to 
analyze, relative to the other schemes. 

It is impossible to use only two product pure states: 
Let \4>o) = lO/lV) (which is general since the basis is 
arbitrary), and \4>i) a state which is orthogonal to it; 
Clearly, |0i> = |li'x2> or |<£i> = \xih") (with arbi- 
trary state x, an d with 1 orthogonal to in each primed 
or double-primed basis) are the only two possibilities to 
choose a two-particle state orthogonal to |0o). For any of 
these choices the entire information can be cloned by Eve 
by cloning the appropriate particle (e.g. the first particle 
in the first choice of |^i)); similar argument is true when 
using higher dimensions or larger number of particles. 

Note that we did not describe the scheme of [|l3j in 
terms of cloning, since a more complicated involvement 
of the third party (Bob) is needed for its description. 
Two-way communication between Alice and Bob plays a 
vital role in this scheme, and it is not clear yet if our new 
no-cloning principle suffices to explain why this scheme 
works. 

The natural simplest (achievable) possibilities are to 
use only three orthogonal pure states or two pure orthog- 
onal states and one mixed state which is orthogonal to 
both; as far as quantum key distribution is concerned, let 
two pure non entangled states carry the secret key, and 
the third non entangled state (pure or mixed) provide 
the protection from cloning (this is called "data rejected 
protocol"): The states 



x2 = io^i 2 )(ori 2 i + iiri2>(iri 2 i , 



(18) 



Po) = |0i0 2 ) ; \4>i) = |li0 2 ) 



(16) 



will be two states which carry the key (in the first qubit), 
and in addition the state 
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= \0[ X) U) 



(17) 



or alternatively, an equal mixture of this state and 



provide the protection from cloning. Such schemes (espe- 
cially the second) are as simple as ]ll] as far as practical 
implementation is concerned, but might be much simpler 
to analyze, since Eve can only obtain information in one 
basis. 

In this work we discussed the impossibility to clone 
orthogonal states of combined systems in various case, 
based on the impossibility to clone non orthogonal mixed 
states. We presented a unified formalism for several 
schemes in quantum key distribution based on our new 
no-cloning argument for orthogonal states. We corrected 
an unjustified claim regarding the role of Eq. (2) in quan- 
tum key distribution, and solved a dispute regarding the 
use of orthogonal states in quantum key distribution. Fi- 
nally we suggested the simplest schemes which are based 
on this principle. 
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